Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack

A takeover of the polyfill.io domain resulted in the polyfill.js library being altered to inject obfuscated malicious JavaScript that redirects victims (notably mobile users) to scam and adult sites; the issue affects over 110,000 sites, prompted warnings and mitigations from Google, Cloudflare and others, and is discussed alongside a critical Adobe Commerce vulnerability (CVE-2024-34102) and related Linux iconv issue that could compound impact to enable remote code execution.